[dns-operations] broken 'apex' NSEC3 for ma. denies big number of delegated names

[Viktor Dukhovni]

On Mon, Oct 05, 2026 at 03:02:22PM +0200, Winfried via dns-operations wrote:

> This problem has recurred (or still persists).

Confirmed, the NSEC3 RR matching the zone apex is much too broad,
implausibly covering a large fraction of the hash space.  The "TEST" in
the "4TEST..." next hash is an interesting coincidence if it is one...

    ; NXDOMAIN qr rd ra ad do
    horizonalmaz.ma. IN A ?
    ma. IN SOA c.tld.ma. ma.anrt.ma. 2039671745 900 90 604800000 1800
    MFB8BPVI7H18DJ77DCIKCMDJGHII3D5B.ma. IN NSEC3 1 0 10 4f6e444c70554fbafbb2 4TESTIB4CP7V1199LBC5JAUG3FG5L7BM NS SOA RRSIG DNSKEY NSEC3PARAM
    RVVP1VSAOPNC2VEO2BARL92RAPR7UN0C.ma. IN NSEC3 1 0 10 4f6e444c70554fbafbb2 S007HCEBT4P1OEQG7Q49FT2TJRKK5TVQ NS
    4UKA75NLNGJC3GHJBLLGE7QJB6GD551F.ma. IN NSEC3 1 0 10 4f6e444c70554fbafbb2 4UKI7IER42K636QMF1TJ6NT0A75FQTDU NS

    $ ldns-nsec3-hash -t 10 -s 4f6e444c70554fbafbb2 ma.
    mfb8bpvi7h18dj77dcikcmdjghii3d5b.
    $ ldns-nsec3-hash -t 10 -s 4f6e444c70554fbafbb2 '*.ma'
    rvvsikok02v87r5s7e960ds4iomven8c.
    $ ldns-nsec3-hash -t 10 -s 4f6e444c70554fbafbb2 horizonalmaz.ma
    4ukculhja1t6h5c3eqfdfkarm63ntl84.

> One example is bankalmaghrib.ma.:

And indeed that lies in the excluded range:

    $ ldns-nsec3-hash -t 10 -s 4f6e444c70554fbafbb2 bankalmaghrib.ma
    qh1m00s34qt97cbgrdmln64s86j39crq.


> We have already sent a report to ma at anrt.ma. No response so far. Does anyone
> happen to know a better contact?

FWIW, the SOA rname is <dnsmaster at anrt.ma> and the DMARC rua/ruf contact
email addresses are both <dsi-infra at anrt.ma>.

-- 
    Viktor.  🇺🇦 Слава Україні!